- wlug - list.wlug.org.nz

US ISP Verizon Wireless To Stop Giving Out Static IPv4 Addresses
by Lawrence D'Oliveiro 10 Mar '17

10 Mar '17

New business customers with Verizon Wireless will no longer get static IPv4 addresses. Instead, they will get “persistent prefix” IPv6 addresses <https://www.theregister.co.uk/2017/03/10/verizon_running_out_of_ipv4_addres…>. I assume “persistent prefix” means they get a fixed value for the top 48 bits, and they can do what they like with the bottom 80 bits. This /48 subnet allocation seems to be the common thing for IPv6.

1 0

Engineering Around Social Media Border Searches
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

In the wake of the plan floated by the US Government to demand passwords to social media accounts from people wanting to enter the country, here <http://freedom-to-tinker.com/2017/02/10/engineering-around-social-media-bor…> is a discussion of some likely countermeasures that should still give the cover of plausible deniability.

1 3

Quote Of The Week
by Lawrence D'Oliveiro 08 Mar '17

08 Mar '17

“One of the reasons society hasn't destroyed itself is that people with intelligence and skills tend to not be criminals for a living. If it ever became a viable career path, we're doomed.” -- Bruce Schneier <https://www.schneier.com/blog/archives/2017/03/building_smarte.html>

1 0

Litebook launches a $249 linux laptop
by Ron Dean 07 Mar '17

07 Mar '17

Presumably this is in $US -- Ron Dean Unit 61 Village Gardens 16 Rototuna Road Hamilton 3210 New Zealand Home 64 7 8493904 Mob 02102259172

1 0

The City of Munich Might Stick With Linux
by Peter Reutemann 06 Mar '17

06 Mar '17

'Munich's "LiMux" project brought FOSS software to their city's IT administration -- until a vote last month on whether to abandon Linux and return to Windows. "Since this decision was reached, the majority of media have reported that a final call was made to halt LiMux and switch back to Microsoft software," reports the Free Software Foundation Europe. "This is, however, not an accurate representation of the outcome of the city council meeting." An anonymous reader quotes their report: The opposing parties were overruled, but the decision was amended such that the strategy document must specify which LiMux-applications will no longer be needed, the extent in which prior investments must be written off, and a rough calculation of the overall costs of the desired unification... [Only then will the city council make their final decision...] We succeeded thus far in forcing the mayor Dieter Reiter to postpone the final decision, and this was possible through the unwavering pressure created by joint efforts between The Document Foundation, KDE, OSBA, and the FSFE together with all the individuals who wrote to city council members and took the issue to the media. Although the mandate is highly suggestive in that it suggests that the existing vendor-neutral approach is to be replaced with a proprietary solution, it leaves the door open... The new mandate buys us some time. And we will keep going. Some politicians said they'd never received this much input from the public before, and the Free Software Foundation Europe says the city's issues were caused "from organizational problems, including lack of clear structures and responsibilities," which should not be attributed to the Linux operating system. "LiMux as such is still one of the best examples of how to create a vendor-neutral administration based on Free Software."' -- source: https://linux.slashdot.org/story/17/03/04/0532214 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Litebook Launches A $249 Linux Laptop
by Peter Reutemann 06 Mar '17

06 Mar '17

'It's "like a Chromebook for Linux users on a budget," reports ZDNet. The new 2.9-pound Litebook uses Intel's Celeron N3150 processor and ships with a 14.1-inch display and a 512-gigabyte hard drive with full HD resolution (1,920 x 1,080). For $20 more they'll throw in a 32-gigabyte SSD to speed up your boot time. "Unlike Windows laptops, Litebooks are highly optimized, come without performance hogging bloatware, [are] designed to ensure your privacy, and are entirely free of malware and viruses," writes the company's web site. They also add that their new devices "are affordable, customizable, and are backwards compatible with Windows software."' -- source: https://linux.slashdot.org/story/17/03/06/0050203 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Tim Berners-Lee Endorses DRM In HTML5, Offers Depressingly Weak Defense Of His Decision
by Lawrence D'Oliveiro 02 Mar '17

02 Mar '17

Has the godfather of the Web just sold it down the river? <https://www.techdirt.com/articles/20170301/03062936815/tim-berners-lee-endo…>

2 1

Researchers find “severe” flaw in WordPress plugin with 1 million installs
by Peter Reutemann 01 Mar '17

01 Mar '17

'More than 1 million websites running the WordPress content management system may be vulnerable to hacks that allow visitors to snatch password data and secret keys out of databases, at least under certain conditions. The vulnerability stems from a "severe" SQL injection bug in NextGEN Gallery, a WordPress plugin with more than 1 million installations. Until the flaw was recently fixed, NextGEN Gallery allowed input from untrusted visitors to be included in WordPress-prepared SQL queries. Under certain conditions, attackers can exploit the weakness to pipe powerful commands to a Web server's backend database.' -- source: https://arstechnica.com/security/2017/02/severe-vulnerability-in-wordpress-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New $10 Raspberry Pi Zero comes with Wi-Fi and Bluetooth
by Peter Reutemann 01 Mar '17

01 Mar '17

'The newest member of the Raspberry Pi product line costs just $10 plus tax and includes Wi-Fi and Bluetooth capability. The "Raspberry Pi Zero W" is an updated version of the Raspberry Pi Zero. While it lacks some niceties, like Ethernet and full-sized USB-A ports, it's smaller than the flagship Pi and a fraction of the cost. The original Raspberry Pi Zero was released in November 2015 at a price of just $5/£4. The new Pi Zero W is almost identical to the original, but doubles the price to $10 and adds a wireless chip that supports 802.11b/g/n Wi-Fi (2.4GHz-only) and Bluetooth 4.0.' -- source: https://arstechnica.com/information-technology/2017/02/new-10-raspberry-pi-… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

CSS font-size parameter
by Ian Stewart 27 Feb '17

27 Feb '17

Hi All, There was discussion at last nights meeting regarding the CSS "font-size" property and which units to use. E.g. px (pixels), % (percentage), pt (point), or em (a unit in the field of typography originally based on the width of an "M"), . Note that there are more than just these four units, see here<https://www.w3.org/Style/Examples/007/units.en.html>. If you buy-off on the statements from w3schools.com, then this<http://%20https://www.w3schools.com/TAgs/ref_pxtoemconversion.asp> web-page provides a pixel to em converter, and to quote from their CSS page<https://www.w3schools.com/css/css_font.asp>... "Note: If you do not specify a font size, the default size for normal text, like paragraphs, is 16px (16px=1em)." "The em size unit is recommended by the W3C. 1em is equal to the current font size. The default text size in browsers is 16px. So, the default size of 1em is 16px. The size can be calculated from pixels to em using this formula: pixels/16=em." Although admitting there is much debate over which is the better approach, Kyle Schaeffer, on his website<http://kyleschaeffer.com/development/css-font-size-em-vs-px-vs-pt-vs/>, adds in an addendum from 2011... "Generally, when I create a new design, I will use percent on the body element (body { font-size: 62.5%; }), and then use the em unit to size it from there." Or, for some quotes from wikipedia...<https://en.wikipedia.org/wiki/Em_(typography)> "One em was traditionally defined as the width of the capital M in the current typeface and point size..." "In Cascading Style Sheets, the em unit is the height of the font in nominal points or inches." ...And finally there is one "rem" to save us all... "To make style rules that depend only on the default font size, another unit was developed: the rem. The rem, or root em, is the font size of the root element of the document. Unlike the em, which may be different for each element, the rem is constant throughout the document." More on rem's here<https://www.w3.org/Style/Examples/007/units.en.html#future> cheers, Ian.

1 0

Running Emacs As A Daemon With systemd
by Lawrence D'Oliveiro 26 Feb '17

26 Feb '17

Some instructions here <http://blog.refu.co/?p=1296> for creating a systemd “.service” file for running Emacs. Initially he did it as a privileged systemwide service, then he figured out how to make it per-user without needing special privileges. (Found in a user comment to this article <http://www.phoronix.com/scan.php?page=news_item&px=systemd-233>.)

1 0

Image-To-Image Translation In TensorFlow
by Lawrence D'Oliveiro 24 Feb '17

24 Feb '17

This page <http://affinelayer.com/pixsrv/index.html> lets you create schematic renditions of various kinds of objects, and then synthesize corresponding photorealistic representations of those objects, based on pieces of images taken from the training databases. You can draw your own outlines, or just click the “Random” buttons to see what it does. Results range from entertaining to disturbing.

1 0

“Smart Contracts” May Not Be So Smart
by Lawrence D'Oliveiro 23 Feb '17

23 Feb '17

To review, “smart contracts” are a feature of some blockchain-based systems, which allow an interaction between multiple parties to be encoded as a set of rules which will be executed automatically by the system, so that neither the parties nor anyone else can prevent those rules from being enforced. ... To give just one example, a legal contract need not try to anticipate absolutely every relevant event that might occur. If some weird thing happens that is not envisioned in a regular legal contract, the parties can work out a modification to the contract that seems reasonable to them, and failing that, a judge might decide the outcome, subject to established legal principles. Similarly, a single error or “bug” in writing a regular contract, causing its literal meaning to differ from what the parties intended, is unlikely to lead to extreme results because the legal system will often resolve such a problem by trying to be reasonable. Contrast this with “smart contracts” where a bug in a “contract’s” code can lead to a perverse result that may allow one party to exploit the bug, extracting much of the value out of the arrangement with no recourse for the other parties. That’s what happened with the DAO in Ethereum, leading to a controversial attempt to unwind a legal-according-to-the-rules set of transactions, and dividing the Ethereum community. <http://freedom-to-tinker.com/2017/02/20/smart-contracts-neither-smart-not-c…>

1 0

Catching Fishing Pirates With Signals Analysis
by Lawrence D'Oliveiro 22 Feb '17

22 Feb '17

Every vessel on the ocean broadcasts its identity and location using the automatic identification system (AIS), which is mostly used to prevent ships from colliding. These days it can also be used to track ship locations, as most AIS data is relayed through satellites. If you want to hide on the sea, the first thing you do is make your vessel "dark" by turning off your AIS broadcasts. What's interesting about pirate fishing vessels, however, is that they need to rendezvous with legitimate reefers if they want to get paid for their catch. To find the pirates, Amos told Ars, he and Bergman needed to look for odd patterns in the behavior of reefers. The group partnered with Global Fishing Watch to work on mapping satellite AIS data, and those patterns began to emerge. "Often with reefers they come to a halt in the middle of the ocean," Amos said. "We don’t see other broadcasting vessels, but we can be confident based on what that ship is doing that they must be rendezvousing with dark vessels." <https://arstechnica.com/tech-policy/2017/02/to-catch-a-thief-with-satellite…> I guess this counts as a “big data” application...

1 0

ESA Adopts CC-BY-SA
by Lawrence D'Oliveiro 21 Feb '17

21 Feb '17

The European Space Agency is releasing its images and videos under a Free Creative Commons licence <https://www.theregister.co.uk/2017/02/21/esa_turns_valve_pours_open_images_…>. This kind of thing is long overdue. Though I can imagine some commercial entities not liking the sharealike proviso...

1 0

meeting next Monday
by Peter Reutemann 21 Feb '17

21 Feb '17

Hi everyone We have a meeting coming up next Monday: "With Firefox losing against Chrome and sliding lower and lower in the browser rankings, how about we have a good look at the browsers available for Linux and benchmark them? Michael Cree has been to linux.conf.au recently and will talk a bit about his experience. " More details: https://www.meetup.com/WaikatoLinuxUsersGroup/events/237234743/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When The Internet Of Things Meets The Second-Hand Market
by Lawrence D'Oliveiro 20 Feb '17

20 Feb '17

The global head of IBM's X-Force Red penetration-testing team, Charles Henderson, created a flurry at RSA last week by relating how a connected car app could still access a car he traded in – two years after he'd sold it. ... Henderson feels that none of that should have been possible years after he disposed of the car. Especially as he says he ran a factory reset, reset his garage door and had traded the old car through a factory dealership ... which ... should have revoked his access to the old car. <https://www.theregister.co.uk/2017/02/20/connected_car_in_the_secondhand_lo…> Seems to me this could happen with other kinds of “smart” devices as well.

1 0

Aboard A Cable Survey Ship
by Lawrence D'Oliveiro 17 Feb '17

17 Feb '17

I mention this <http://www.theregister.co.uk/2017/02/16/iregi_tours_submarine_cable_survey_…> because it is scouting out the route for the “Southern Cross NEXT” cable. And also it was formerly an NZ Navy vessel.

1 0

Linus Torvalds: Talk of Tech Innovation is Bullshit. Shut Up and Get the Work Done
by Peter Reutemann 16 Feb '17

16 Feb '17

'Linus Torvalds believes the technology industry's celebration of innovation is smug, self-congratulatory, and self-serving. From a report on The Register: The term of art he used was more blunt: "The innovation the industry talks about so much is bullshit," he said. "Anybody can innovate. Don't do this big 'think different'... screw that. It's meaningless. Ninety-nine per cent of it is get the work done." In a deferential interview at the Open Source Leadership Summit in California on Wednesday, conducted by Jim Zemlin, executive director of the Linux Foundation, Torvalds discussed how he has managed the development of the Linux kernel and his attitude toward work. "All that hype is not where the real work is," said Torvalds. "The real work is in the details." Torvalds said he subscribes to the view that successful projects are 99 per cent perspiration, and one per cent innovation.' -- source: https://linux.slashdot.org/story/17/02/16/1530223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

An Ordinary User?s Adventures In Linux
by rowan schischka 16 Feb '17

16 Feb '17

Third party ink works but don't fill up 100% and save OEM ink to periodically flush. I did not use a cheap printer for a few weeks and the third party ink blocked up the plumbing.

1 0

Google's Not-so-secret New OS
by Peter Reutemann 16 Feb '17

16 Feb '17

'According to reports late last year, Google is working on a new operating system called Andromeda. Much about it is still unknown, but according to the documentations Google has provided on its website, it's clear that the Fuchsia is the actual name of the operating system, and the kernel is called Magenta. A tech enthusiast dug around the documentations to share the followings: To my naive eyes, rather than saying Chrome OS is being merged into Android, it looks more like Android and Chrome OS are both being merged into Fuchsia. It's worth noting that these operating systems had previously already begun to merge together to an extent, such as when the Android team worked with the Chrome OS team in order to bring Update Engine to Nougat, which introduced A/B updates to the platform. Google is unsurprisingly bringing up Andromeda on a number of platforms, including the humble Intel NUC. ARM, x86, and MIPS bring-up is exactly what you would expect for an Android successor, and it also seems clear that this platform will run on Intel laptops. My best guess is that Android as an API and runtime will live on as a legacy environment within Andromeda. That's not to say that all development of Android would immediately stop, which seems extremely unlikely. But Google can't push two UI APIs as equal app frameworks over the long term: Mojo is clearly the future. Ah, but what is Mojo? Well it's the new API for writing Andromeda apps, and it comes from Chromium. Mojo was originally created to "extract a common platform out of Chrome's renderer and plugin processes that can support multiple types of sandboxed content."' -- source: https://mobile.slashdot.org/story/17/02/15/1023242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

JavaScript Attack Breaks ASLR On 22 CPU Architectures
by Peter Reutemann 16 Feb '17

16 Feb '17

'Five researchers from the Vrije University in the Netherlands have put together an attack that can be carried out via JavaScript code and break ASLR protection on at least 22 microprocessor architectures from vendors such as Intel, AMD, ARM, Allwinner, Nvidia, and others. The attack, christened ASLRCache, or AnC, focuses on the memory management unit (MMU), a lesser known component of many CPU architectures, which is tasked with improving performance for cache management operations. What researchers discovered was that this component shares some of its cache with untrusted applications, including browsers. This meant that researchers could send malicious JavaScript that specifically targeted this shared memory space and attempted to read its content. In layman's terms, this means an AnC attack can break ASLR and allow the attacker to read portions of the computer's memory, which he could then use to launch more complex exploits and escalate access to the entire OS. Researchers have published two papers [1, 2] detailing the AnC attack, along with two videos[1, 2] showing the attack in action.' -- source: https://developers.slashdot.org/story/17/02/15/2149235 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

QOTW
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

Re the Internet of Things: A doctor friend of mine said to me many years ago, "Good thing they won't let you put 'General Protection Fault' down as a cause of death on the certificate." <https://forums.theregister.co.uk/forum/containing/3104004>

1 0

Bruce Schneier At The Open Source Leadership Summit
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

"We all had this special right to code the world as we saw fit," said Schneier. "My guess is we're going to lose that right, because it's too dangerous to give to a bunch of techies." <http://www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_c…>

1 0

Would A Phone That Makes Calls Fly In 2017?
by Lawrence D'Oliveiro 15 Feb '17

15 Feb '17

A company called HMD Global wants to bring back the legendary Nokia 3310 candy-bar phone <https://arstechnica.com/gadgets/2017/02/report-hmd-to-resurrect-legendary-n…>. You regularly see comments from people lamenting the complexity of modern smartphones, and wishing for a return to the simpler days of mobile phones that were good at making calls, with less of all the extra bells and whistles. As well as having much longer battery life. Now we will see if resurrecting a popular model from the days when phones did exactly that will succeed, given that today making calls is one of the last things that people do with their phones...

3 2

Engineering Around Social Media Border Searches
by rowan schischka 15 Feb '17

15 Feb '17

What happens when the 2-factor authentication text gets sent to my NZ phone number, i cant exactly hand that over. I think ill start a bot that posts cat pictures from a fake account. Give the authorities what they want to see. -- Kind Regards Rowan Schischka

1 0

Now sites can fingerprint you online even when you use multiple browsers
by Peter Reutemann 14 Feb '17

14 Feb '17

'Researchers have recently developed the first reliable technique for websites to track visitors even when they use two or more different browsers. This shatters a key defense against sites that identify visitors based on the digital fingerprint their browsers leave behind.' -- source: https://arstechnica.com/security/2017/02/now-sites-can-fingerprint-you-onli… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Web Copy-Protection As A Censorship Tool
by Lawrence D'Oliveiro 13 Feb '17

13 Feb '17

There has been ongoing work at the W3C for some time to standardize “Encrypted Media Extensions” (EME), with the usual claims that many publishers will refuse to offer their content without this kind of “protection”. The mitigating argument has been made that such a “feature” would be optional--the browser user could always turn it off. Well, it turns out Google has removed the option to disable its implementation of EME from Chrome. A further worry is that many countries’ copyright laws include provisions that prohibit the circumvention of copy-protection mechanisms. So work by security researchers to audit browsers that implement EME could be interpreted as violations of such provisions. Many have requested that the W3C explicitly state that EME conformance cannot be (ab)used in such a way, but so far it has refused. <https://www.techdirt.com/articles/20170201/14285436609/codification-web-drm…>

1 1

The City Of Munich Now Wants To Abandon Linux And Switch Back to Windows
by Peter Reutemann 12 Feb '17

12 Feb '17

'"The prestigious FOSS project replacing the entire city's administration IT with FOSS based systems, is about to be cancelled and decommissioned," writes long-time Slashdot reader Qbertino. TechRepublic reports: Politicians at open-source champion Munich will next week vote on whether to abandon Linux and return to Windows by 2021. The city authority, which made headlines for ditching Windows, will discuss proposals to replace the Linux-based OS used across the council with a Windows 10-based client. If the city leaders back the proposition it would be a notable U-turn by the council, which spent years migrating about 15,000 staff from Windows to LiMux, a custom version of the Ubuntu desktop OS, and only completed the move in 2013... The use of the open-source Thunderbird email client and LibreOffice suite across the council would also be phased out, in favor of using "market standard products" that offer the "highest possible compatibility" with external and internal software... The full council will vote on whether to back the plan next Wednesday. If all SPD and CSU councillors back the proposal put forward by their party officials, then this new proposal will pass, because the two parties hold the majority. The leader of the Munich Green Party says the city will lose "many millions of euros" if the change is implemented. The article also reports that Microsoft moved its German headquarters to Munich last year.' -- source: https://yro.slashdot.org/story/17/02/11/1930217 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Bored with ho-hum cloud backups? Use Usenet (yes, Usenet!) instead
by Peter Reutemann 11 Feb '17

11 Feb '17

'Cloud backups these days are all the rage—for good reason. Rather than dealing with shuffling physical media offsite, you can simply back up the data offsite, where it can be stored in one of many professionally monitored data centers. Unfortunately, this kind of service isn’t free, and the cost can be a barrier. However, there is a cost-effective way to store your cloud backups: Usenet. With access to a Usenet news server, you can simply upload your backup there, and it will be stored redundantly in news servers all over the world. Best of all, this approach typically costs considerably less than a cloud backup service.' -- source: https://arstechnica.com/information-technology/2017/02/bored-with-ho-hum-cl… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Oracle refuses to accept pro-Google “fair use” verdict in API battle
by Peter Reutemann 11 Feb '17

11 Feb '17

'Google successfully made its case to a jury last year that its use of Java APIs in Android was "fair use." A San Francisco federal jury rejected Oracle's claim that the mobile system infringed Oracle's copyrights. But Oracle isn't backing down. Late Friday, the company appealed the high-profile verdict to a federal appeals court. This is the latest stage of a seemingly never-ending legal battle over intellectual property that began in 2010. The conflict has meandered through two federal trials, in addition to multiple trips to the appellate courts and to the Supreme Court. Oracle opened its brief to the US Court of Appeals for the Federal Circuit right where it left off after losing its case. Among other things, Oracle is refusing to believe that the "fair use" defense to copyright-infringement allegations should have protected Google from having to pay billions of dollars in damages.' -- source: https://arstechnica.com/tech-policy/2017/02/oracle-refuses-to-accept-pro-go… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

When A Safety Check Becomes A Point Of Failure...
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

All inbound networking for GCE instances, load balancers and VPN tunnels enter via shared layer 2 load balancers. These load balancers are configured with changes to IP addresses for these resources, then automatically tested in a canary deployment, before changes are globally propagated. The issue was triggered by a large set of updates which were applied to a rarely used load balancing configuration. The application of updates to this configuration exposed an inefficient code path which resulted in the canary timing out. From this point all changes of public addressing were queued behind these changes that could not proceed past the testing phase. In other words, the safety system for validating configuration updates before allowing deployment suffered a failure which blocked all configuration updates thereafter. I guess the answer is to add a watchdog for the canaries ... how many more metaphors can I mix in? <http://www.theregister.co.uk/2017/02/10/google_cloud_outage_explanation/>

1 0

We Finally Have A Computer That Can Survive The Surface Of Venus
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

The Venera landers that the USSR sent to Venus in the 1970s and 1980s were able to survive for up to 2 hours by heavy use of refrigeration and pre-cooling. But now researchers are testing electronics based on silicon carbide, which can work without special protection at very high voltages and temperatures: The chip, a simple 3-stage oscillator, kept functioning [in Venus-like conditions] at a steady 1.26MHz for 521 hours (21.7) days before the [test rig] had to be shut down. <https://arstechnica.co.uk/gadgets/2017/02/venus-computer-chip/>.

1 0

Met Goes Public Domain
by Lawrence D'Oliveiro 10 Feb '17

10 Feb '17

New York’s Metropolitan Museum of Art is putting 375,000 digitized images online under a Creative Commons CC0 (effectively Public Domain) licence. As Techdirt notes <https://www.techdirt.com/articles/20170208/13005636669/met-goes-public-doma…>, it shouldn’t have to bother specifying such a licence: we should be able to take for granted that digitizations of public-domain works should themselves be public-domain. Unfortunately, others with control over such works (and sizeable legal budgets) think differently. So all kudos to the Met for making this very clear.

2 1

The Right Not To Be Searchable
by Lawrence D'Oliveiro 09 Feb '17

09 Feb '17

“[A] website in Romania ... obtained and posted Canadian judicial and tribunal decisions. These were all public documents, but they were not previously indexed by Google, which meant their contents were effectively hidden. The Romanian site allowed its copies to be indexed by Google, which made the decisions and the Canadian citizens involved visible for the first time -- something the people affected were not happy about. They complained to the Privacy Commissioner of Canada, who ruled that the Romanian site violated Canadian privacy law.” <https://www.techdirt.com/articles/20170208/02314536660/landmark-court-decis…>

1 0

Microsoft hosts the Windows source in a monstrous 300GB Git repository
by Peter Reutemann 07 Feb '17

07 Feb '17

'Microsoft has been working to enhance Git to improve the way it handles vast repositories. Central to this effort is a new project released (in part) as open source Git Virtual File system (GVFS). The premise of GVFS is straightforward enough: rather than fetching all the data at once, only a bare skeleton of the repository needs to be populated up front. The virtualized file system subsequently retrieves additional data on a demand-driven, as-needed basis. Building one particular Windows component, for example, will cause GVFS to fetch the files that make up that component, along with anything that the component depends on, but it will stop short of fetching all the many hundreds of gigabytes the repository contains.' -- source: https://arstechnica.com/information-technology/2017/02/microsoft-hosts-the-… I remember using SourceSafe way back. It may not have been great, but it was a big improvement over "not having any" version control. :-) Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 4

Intel's Atom C2000 Chips Are Bricking Products – And It's Not Just Cisco Hit
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Certain models of Intel Atom chips are prone to clock-signal failures after about 18 months, rendering them unusable. This seems to be related to a warning put out by Cisco about some of its products, but neither company will confirm there is a link. <http://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product…>

1 0

Chrome 56 Quietly Added Bluetooth Snitch API
by Peter Reutemann 06 Feb '17

06 Feb '17

'When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it.' -- source: https://yro.slashdot.org/story/17/02/06/1425208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

25G/50G Ethernet
by Lawrence D'Oliveiro 06 Feb '17

06 Feb '17

Thought there already was a 100-gigabit-per-second Ethernet spec. But it seems that still isn’t quite practical enough (cost? range?) for common use. Nor is the 40-gigabit-per-second fallback. So here we have two more lesser specs: <http://www.theregister.co.uk/2017/01/31/25g_and_50g_ethernet_spec_finalised/>.

1 1

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by rowan schischka 04 Feb '17

04 Feb '17

It will be interesting to see if advertising companies will exploit this. You can see it as an exploit to track users but it should be possible for users to discover who is tracking them -- Rowan Schischka

1 0

Windows DRM-Protected Files Used To Decloak Tor Browser Users
by Peter Reutemann 03 Feb '17

03 Feb '17

'Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.' -- source: https://yro.slashdot.org/story/17/02/02/231229 Not sure whether that applies to Linux/Wine/IE as well. Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Judge Stops PS3 Linux Settlement
by Lawrence D'Oliveiro 03 Feb '17

03 Feb '17

<https://arstechnica.com/tech-policy/2017/02/game-over-for-ps3-linux-settlem…>: “The California judge presiding over the litigation is now killing the proposed settlement amid concerns the lawyers representing the class haven't explained why they should get $2.25 million for their legal services, especially considering that the deal has made it burdensome on gamers to get their cash.” Seems par for the course for class-action settlements, that the lawyers rake it in in fees, while the actual plaintiffs end up with peanuts...

1 0

How Google fought back against a crippling IoT-powered botnet and won
by Peter Reutemann 02 Feb '17

02 Feb '17

'In September, KrebsOnSecurity—arguably the Internet's most intrepid source of security news—was on the receiving end of some of the biggest distributed denial-of-service attacks ever recorded. The site soon went dark after Akamai said it would no longer provide the site with free protection, and no other DDoS mitigation services came forward to volunteer their services. A Google-operated service called Project Shield ultimately brought KrebsOnSecurity back online and has been protecting the site ever since. At the Enigma security conference on Wednesday, a Google security engineer described some of the behind-the-scenes events that occurred shortly after Krebs asked the service for help, and in the months since, they said yes. While there was never significant hesitancy to bring him in, the engineers did what engineers always do—weighed the risks against the benefits. "What happens if this botnet actually takes down google.com and we lose all of our revenue?" Google Security Reliability Engineer Damian Menscher recalls people asking. "But we considered [that] if the botnet can take us down, we're probably already at risk anyway. There's nothing stopping them from attacking us at any time. So we really had nothing to lose here."' -- source: https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-c… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Gitlab Backups ... What Backups?
by Lawrence D'Oliveiro 02 Feb '17

02 Feb '17

A harried sysadmin accidentally deletes nearly 300GB of data during a troublesome data replication process ... and then they discover that, out of 5 different recovery procedures they thought they had available, none work. <http://www.theregister.co.uk/2017/02/01/gitlab_data_loss/>

2 2

LibreOffice 5.3 Released, Touted As 'One of the Most Feature-Rich Releases' Ever
by Peter Reutemann 02 Feb '17

02 Feb '17

'A new month, and a brand new version of open-source office suite LibreOffice is now available to download. And what a release it is. LibreOffice 5.3 introduces a number of key new features and continues work on improving the look and feel of the app across all major platforms. The Document Foundation describes LibreOffice 5.3 as "one of the most feature-rich releases in the history of the application." One of the headline features is called MUFFIN interface, a new toolbar design similar to the Microsoft Office Ribbon UI.' -- source: https://news.slashdot.org/story/17/02/01/1326204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

System76 GPGPU Server
by Lawrence D'Oliveiro 01 Feb '17

01 Feb '17

System76 announces its new Ibex Pro box <http://www.phoronix.com/scan.php?page=news_item&px=System76-Ibex-Pro-GPU-Se…> which can hold up to nearly 40,000 NVidia CUDA cores <https://system76.com/servers/ibex>. Not sure how many you get for that USD9,575 base price... Seems like there is no really competitive market for GPGPU hardware--it is totally dominated by NVidia, and nobody else gets a serious look-in. So the industry-standard OpenCL API languishes, since the dominant player prefers its own proprietary alternative, and there is little pressure from users to be able to port their code to competing products.

1 0

Google AI on raspberry pi
by rowan schischka 31 Jan '17

31 Jan '17

"Google has developed a huge range of tools for machine learning, IoT, wearables, robotics, and home automation, and it wants Raspberry Pi fans to fill out a survey <https://google.qualtrics.com/jfe/form/SV_3yMNYryaP4WsCwJ?Source=RaspPi> that will help it to understand what tools to provide." http://www.zdnet.com/article/google-is-bringing-ai-to-your-raspberry-pi/ I just took the survey and I don't get any impression of what tools they will bring to the r-pi. It was pretty simple, no email address required to participate. The questions were how old are you, what area are your projects in, and how frequently do you work on your projects. Im sure with the processing power of r-pi we'll see some sort of web API which wouldn't really need to be specific to the r-pi. It will be interesting to watch what they come up with so if you have maker projects, take the survey. -- Rowan Schischka

1 0

Backblaze 2016 Hard Drive Report
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

<https://arstechnica.com/information-technology/2017/01/8tb-hgst-disks-show-…>: Traditionally, the company has stuck with consumer-oriented disks. Backblaze argues that the extra cost of "enterprise" disks doesn't make sense for its usage pattern. Other studies have shown no significant difference in reliability between “enterprise” and “consumer” disks anyway.

2 2

USB-C Power Meter
by Lawrence D'Oliveiro 31 Jan '17

31 Jan '17

With all the worries over bad USB-C cables and vendors that play fast and loose with the power spec, here <https://arstechnica.co.uk/gadgets/2017/01/usb-c-power-meter/> is a measurement gadget that can help to some extent. But as the article says: If you really want to test a new charger or cable before plugging it into an expensive device, your best bet is some DIYish electronics involving a breakout board and a multimeter. But there doesn't seem to be a plug-and-play version of that yet.

1 0

The Trump-And-Dump Bot
by Lawrence D'Oliveiro 30 Jan '17

30 Jan '17

This bot <http://www.theregister.co.uk/2017/01/30/trumps_corporate_twitter_trolling_t…> analyzes Trump’s tweets, identifies the company he is badmouthing, and does a quick short-sell to profit from the momentary dip in the company’s stock value. T3's approach involves using a Python Twitter bot and API calls to services like Indico for machine learning (sentiment analysis and entity recognition), Clearbit for company identification, Google Finance for stock pricing, and E‑Trade for executing the trade. They have been donating the profits to charity. Imagine that--an ethical use for short-selling...

1 0